├── favicon.ico
├── readme_images
├── db.png
├── output.png
├── web_gui.png
├── run_server.png
└── select_file.png
├── .gitignore
├── package.json
├── README.md
├── homepage.html
└── snapback.js
/favicon.ico:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/chrismaddalena/snapback/master/favicon.ico
--------------------------------------------------------------------------------
/readme_images/db.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/chrismaddalena/snapback/master/readme_images/db.png
--------------------------------------------------------------------------------
/readme_images/output.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/chrismaddalena/snapback/master/readme_images/output.png
--------------------------------------------------------------------------------
/readme_images/web_gui.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/chrismaddalena/snapback/master/readme_images/web_gui.png
--------------------------------------------------------------------------------
/readme_images/run_server.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/chrismaddalena/snapback/master/readme_images/run_server.png
--------------------------------------------------------------------------------
/readme_images/select_file.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/chrismaddalena/snapback/master/readme_images/select_file.png
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | notes.txt
2 | *.nessus
3 | *.xml
4 | report/
5 | node_modules/
6 | package-lock.json
7 | *test.js
8 | test.txt
9 | *.csv
10 | *.zip
11 | *_*-*-*_*-*-*.js
12 |
--------------------------------------------------------------------------------
/package.json:
--------------------------------------------------------------------------------
1 | {
2 | "name": "Snapback",
3 | "version": "1.0.0",
4 | "description": "Super Fast HTTP Screenshots",
5 | "main": "snapback.js",
6 | "scripts": {
7 | "test": "echo \"Error: no test specified\" && exit 1"
8 | },
9 | "author": "Forrest Kasler (ph3eds) @fkasler",
10 | "license": "ISC",
11 | "dependencies": {
12 | "archiver": "^3.0.0",
13 | "express": "^4.17.1",
14 | "jquery": "^3.4.1",
15 | "line-reader": "^0.4.0",
16 | "md5-file": "^4.0.0",
17 | "puppeteer": "^1.17.0",
18 | "socket.io": "^2.2.0",
19 | "sqlite3": "^4.0.9",
20 | "xml2js": "^0.4.19"
21 | }
22 | }
23 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | Snapback
2 | ============
3 | Snapback is a HTTP(s) screenshot tool written to take advantage of asynchronous threading in Nodejs. It's like EyeWitness, gowitness, and rawr, etc. but generally faster, and compatible with MacOS, Windows, and Linux.
4 |
5 | Installation
6 | ============
7 | You will need to install Node and NPM (Node Package Manager) to run the project.
8 | I recommend running this tool on the native OS, but it works fine on a VM as well. I have tested on a Kali VM after the basic apt-get install of node and npm without issues. It has also been tested on a Win7 VM with a standard Node.js install.
9 | To install dependencies:
10 |
11 | ```
12 | git clone https://github.com/fkasler/snapback.git
13 | cd snapback
14 | npm install
15 | ```
16 |
17 | That's it. Now you're ready to start collecting screenshots
18 |
19 | Usage
20 | =====
21 |
22 | ```
23 | node snapback.js
24 | ```
25 |
26 | 
27 |
28 | Then navigate to http://localhost:2997 and click the "Select Input File" to start taking screenshots. Snapback currently supports .nessus files, nmap .xml files, ScopeCreep exports, and .txt files with one target url per line.
29 |
30 | 
31 |
32 | 
33 |
34 | This should kick off the scan and should give you screens and html data in a folder called "report".
35 |
36 | 
37 |
38 | The "report" folder is created by the tool if it does not exist. To start a new scan/project simply move or remove the "report" folder, restart the server side ("node snapback.js"), and refresh the web GUI.
39 |
40 | You can also use a socks5 or HTTP proxy by checking the "Use Proxy" box and specifying the proxy location. For example, to scan through a remote box over port 8080, set up the proxy with:
41 |
42 | ```
43 | ssh username@remote.server.com -D 8080
44 | ```
45 |
46 | Then add "socks5://localhost:8080" as your proxy setting in Snapback.
47 |
48 | The "Delay" setting allows the user to set a number of seconds to wait, after intial page load events, before taking the screenshot. This can be useful when services are rendering slowly.
49 |
50 | The "No Sandbox" setting is just to get around restrictions running the headless browser as root. It is really only useful for running the tool on Kali Linux or similar without needing to jump through a bunch of hoops.
51 |
52 | Report checkboxes are saved automatically. Report notes are saved on "focusout" so just click outside of the input and your notes will be saved. The notes feature is meant to keep track of default/weak creds you find.
53 |
54 | A cool use case for this tool is data mining. Because the HTML of each page is saved in your report folder, you can create a .txt input file of pages to scrape and then use a little grep/sed/vim foo to get the data you want from each page of HTML. I found myself mining a lot of emails using this method so I went ahead and built it into the tool. Just check the 'scrape emails' checkbox before scanning and the tool will run some JavaScript on each page to do an email regex search. Results are stored in a file called 'emails.txt' in your report folder.
55 |
56 | Don't like the web UI? Prefer to live in the CLI? No problem! You can specify an input file from the command line like so:
57 |
58 | ```
59 | node snapback.js /full/path/to/my/input_file.nessus
60 | ```
61 |
62 | Want to use a proxy from the CLI? Just specify the proxy as an additional argument after your input file:
63 |
64 | ```
65 | node snapback.js /full/path/to/my/input_file.nessus socks5://localhost:8080
66 | ```
67 |
68 | Reporting
69 | =====
70 | To export just a .zip with a copy of your sqlite database and screenshots that might be pulled into a report (auth prompts and weak creds), you can use the "Report Export" button. The .zip will be stored in your Snapback project root.
71 |
72 | The database is only a single table "services" with the following structure:
73 |
74 | 
75 |
76 | **url** TEXT NOT NULL UNIQUE - the URL of the image
77 |
78 | **image_path** TEXT - the file path to the captured image relative to the snapback project root
79 |
80 | **image_hash** TEXT - md5 hash of the captured image for fingerprinting/grouping
81 |
82 | **text_path** TEXT - path to the html of the captured page relative to the snapback project root
83 |
84 | **text_hash** TEXT - md5 hash of the captured html for fingerprinting/grouping
85 |
86 | **text_size** INTEGER - RESERVERD BUT NOT USED YET for fingerprinting/grouping
87 |
88 | **captured** INTEGER - 1 == Captured, 0 == Not Captured
89 |
90 | **error** INTEGER - 1 == Error Capturing, 0 == No Error Capturing (yet... may not have run against this URL)
91 |
92 | **viewed** INTEGER - 1 == Viewed, 0 == Not Viewed
93 |
94 | **default_creds** TEXT - Used to record default creds that the user finds
95 |
96 | **auth_prompt** INTEGER - 1 == There is an auth prompt on the page, 0 == No auth prompt detected
97 |
98 | **notes** TEXT - Used to record device type or other notes for further testing/investigation
99 |
100 | Happy Hacking :)
101 |
--------------------------------------------------------------------------------
/homepage.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |